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DETAILED ACTION 

This Action is in regards to the Reply received on 1 1/04/2005. 

Response to Amendment 

1 . This action is responsive to the applicant's argument filed on 1 1/04/2005. 

By the present amendment, claims 1, 5, 7-10, 15, 17-20, 23, 24, 26, 29-32, 34-37, 40, 
41 , 46, 48, and 50 are amended and claims 4 and 39 are cancelled without prejudice or 
disclaimer. 

Reconsideration of the previous rejection is herein submitted and allowance of 
the instant application are respectfully requested buy the applicants, is not granted 
because the application is not in condition for allowance as specified below . 

Claim Rejections - 35 USC § 112 

2. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

3. Claim 15 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

Claim 1 , recites the phrase "establishing the identity of the sender'' in line 4. 
There is no antecedent basis for this limitation in the claim. 

Claim 20, recites the phrase "determining the disposition of incoming. " in line 1. 
There is no antecedent basis for this limitation in the claim. 
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Claim 24, recites the phrase "determining the disposition of incoming, " in line 1. 
There is no antecedent basis for this limitation in the claim. 

Claim 37, recites the phrase ''determining tlie disposition of incoming," in line 2. 
There is no antecedent basis for this limitation in the claim. 
The above noticed problems are just exemplary. Correction is required. 

Claim Rejections - 35 USC §112 

4. Claims 21 and 22 are rejected under 35 U.S.C. 112, first paragraph, as failing to 
comply with the written description requirement. The claim(s) contains subject matter, 
which was not described in the specification in such a way as to reasonably convey to 
one skilled in the relevant art that the inventor(s), at the time the application was filed, 
had possession of the claimed invention. 

Regarding independent claims 1 and 20, 24, 26, and 37, the term "penalty count 
." is not enabled in the specification in such a way one of ordinary skill in the art 
understand the limitation of the claimed invention. It has not been described what is a 
penalty. Furtermore it is not clear in view of the independent claims how one 
determines a cumulative penalty count and how will this concept is enabled in this 
invention 

On the other hand, the term determining the disposition of the incoming mail is 
vague and broad and is not enabled in the specification in such a way one of ordinary 
skill in the art understand the limitation of the claimed invention. It has not been 
described what is a penalty. 
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The above noticed problems are just exemplary. Applicants are required to 
correct the same. 



Response to Arguments 

5. Applicant's arguments with respect to independent claims 1 , 20, 24, 26 and 37 
have been carefully considered, but are not deemed fully persuasive. Furthermore, 
applicant's argument regarding previously rejected claims have also been fully 
considered and are not persuasive. Applicant's arguments are deemed moot in view of 
the following new ground of rejection as explained here below, necessitated by 
Applicant substantial amendment (i.e., a method an apparatus wherein determining said 
cumulative penalty count value comprises assessing a penalty count value to said 
sender identifier for an undesirable activity performed by the sender) to the claims which 
significantly affected the scope thereof. The dependent claims stand rejected as 
articulated in the First Office Action and all objections not addressed in Applicant's 
response are herein reiterated. 

In response to Applicant's arguments, 37 CFR § 1 .1 1 (c) requires applicant to 
"clearly point out the patentable novelty which he or she thinks the claims present in 
view of the state of the art disclosed by the references cited or the objections made. He 
or she must show the amendments avoid such references or objections." 

The Examiner maintains the arguments presented in the previous Office Action 
as outlined below and the rejection is therefore sustained. 
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Claim Objections 

1. Claims 14-16, 18, 19, 31, 35, 36, 45-47, 49, and 50 are objected to as 
being dependent upon a rejected base claim, but would be allowable if rewritten in 
independent form including all of the limitations of the base claim and any intervening 
claims. 



Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 1-3, 5-10, 20-28, 29, 30, 32-34, and 37, 38, 40, and 41 are rejected 
under 35 U.S.C. 103(a) as being unpatentable over Donaldson et al (Donaldson), U.S. 
6,321,267 B1 in view of Porras et al. (Porras), U.S. Patent No. 6,484,203 B1. 

Regarding claim 1, Donaldson discloses the invention substantially as claimed. 
Donaldson teaches teach a method suitable for use in a communication device for 
determining the disposition of incoming e-mail from a sender {column 2, lines 37-41; fig. 
1, items 1045-1048), said method comprising the steps of: 

establishing the identity of the sender to provide a sender identifier {column 6, 
lines 14-20; column 14, lines 63-67; fig. 14, items 1401-1406)] 

determining a cumulative penalty count value associated with said sender 
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identifier {column 23, lines 25-36; column 22, lines 25-33; fig. 16, items 1500-1518; note 
that the penalty count value here is the threshold number points or the matching count)] 

retrieving a system resource usage status associated with the communication 
device {column 6, lines 42-52)] and 

processing the incoming e-mail on the basis of said cumulative penalty count 
value and said system resource usage status {column 22, lines 28-33; column 16, 12- 
64),; however, Donalson does not pecifically teach the details of a method 'Wherein 
determining said cumulative penalty count value comprises assessing a penalty count 
value to said sender identifier for an undesirable activity performed by the sender". 

In the same field of endeavor, Porras discloses ( . . . A^i^jjy illi^li^^ 
anornaioiis data trarisfbire might include a continuous measum <)f fite transfer size^ 
bateabricai rneasura of the -soured or destMon directory of the" data trari^ife 
measure of corrimands correst^^ b^dat^ tran^fer$i(e:<j^^[ c^ downibad^data): 
These measures a Wide Vanetv of da such aj^ a liargej volume 

of $111^11 data transfers Vf^Vrn^il^ordoWhioajd rnassk. ■ The hionitor mav 

disShdufeh^betyveen network packets ib^^ed on thb timb ^u Vvefe rbcbived by the 

network Mitv/pefmi^^^^^ statistical analWi^ to distinquishibetvyeen a ridrmal data transfer 
during- a workdav and an abnorrnai^data transfer on a weekend evening . . . ) [see Porras, 
column 12, lines 27-40]. 

Accordingly, it would have been obvious to one of ordinary skill in the networking 
art at the time the invention was made to have incorporated Porras's teachings of 
determining penalty count value to said sender identifier for an undesirable activity 
performed by the sender with the teachings of Donaldson, for the purpose of " 
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detecting suspicious network activity based on analysis of network traffic data 
selected. . . and automatically receive and integrate the reports of suspicious activity " 
as stated by Porros in lines 1-9 of column 2. By this rationale claim 1 is rejected. 

Regarding claim 2: The combination of Donaldson-Porras teach the method of 

claim 1 wherein said step of establishing the identity of the sender comprises the step of 

ascertaining an IP address for the sender {column 6, lines 14-20). 

Regarding claim 3: The combination of Donaldson-Porras teach the method of 

claim 1 wherein said step of establishing the identity of the sender comprises the step of 

associating the sender with a peer IP address of the sender TCP connection {column 6, 

lines 42-52), 

Regarding claim 5: The combination of Donaldson-Porras teaches the method 
of claim 4 wherein said cumulative penalty count value comprises an activity penalty 
count charged to the sender for current undesirable sender activity and a time- 
dependent penalty count determined from previous undesirable sender activity {column 
22, lines 23-33; column 5, lines 59-67; column 6, lines 1-2; note that attempting to send 
a copy of the message 100 times suggest that the penalty count dependent on previous 
undesirable sender's activity). 

Regarding claim 6: The combination of Donaldson-Porras teaches the method 
of claim 5 wherein said time-dependent penalty count comprises a zero value 
subsequent to a pre-established retention period {column 17, lines 59-64; note that if 
the result is zero, then the remote host matches the particular node filter). 
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Regarding claim 7: The combination of Donaldson-Porras teaches the method 
of claim 5 wherein said time-dependent penalty count comprises a prior activity penalty 
count value reduced by a time-dependent decay factor {column 21, lines 12-56; note 
that the filter scans the node name of the remote host for certain sequences and adds 
or subtracts points). 

Regarding claim 8: The combination of Donaldson-Porras teaches the method 
of claim 1 wherein said undesirable activity comprises a member of the group consisting 
of: sending a large number of e-mails {column 1, lines 14-20), sending e-mails of 
relatively large sizes {column 1, lines 17-19), using a relatively large amount of TCP 
connection time {column 26, lines 1-1 1), and causing a TCP timeout {column 33, lines 
20-23; Note the appearance of the interrupted TCP connection). 

Regarding claim 9: The combination of Donaldson-Porras teaches the method 
of claim 1 wherein said system overall resource usage status is a function of a member 
of the group consisting of: the number of concurrent TCP connections being maintained 
{column 25, lines 59-64), the number of e-mail files in an incoming message queue, and 
the amount of disk space being utilized for an incoming message queue {column 5, 
lines 52-58; Donaldson et al disclose a message store and its mail queue that keeps 
undelivered messaged for up to a week). 

Regarding claim 10: The combination of Donaldson-Porras teaches the method 
of claim 1 wherein said step of processing the incoming e-mail comprises the step of 
assigning an operating state to the communication device, said operating state being a 
function of said system overall resource usage status {column 16, lines 15-19; 
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Donaldson et al disclose a proxy which deallocates resources and resets internal state 
variables). 

Regarding claim 20: The combination of Donaldson-Porras teaches a 
communication device for determining the disposition of incoming e-mail from a sender, 
said device comprising: 

a penalty count filter module {fig, 13, item 1401) having 

means for identifying the sender {column 6, lines 14-20; column 14, lines 63-67)\ 
means for assigning a penalty count to the sender, said penalty count being a function 
of undesirable activity associated with the sender [see Porras, column 12, lines 27-40], 
means for determining an overall resource usage value for said communication 
device in receiving e-mail {column 16, lines 12-19)] 

means for specifying an operating state for said penalty count filter module, said 
operating state being a function of said overall resource usage value {column 16, lines 
12-19)] and 

an accept/reject filter for disposing of the incoming e-mail on the basis of said 
sender penalty count and said operating state {column 3, lines 43-45). 

Regarding claim 21: The combination of Donaldson-Porras teaches the method 
of claim 20 wherein 

said means for identifying the sender includes means for obtaining at least one of a 
Domain Name Service verification {column 12, lines 45-49) and a peer IP address of the 
sender TCP connection {fig. 14, item 1404; fig, 13, item 1470). 
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Regarding claim 22: The combination of Donaldson-Porras teaches the method 
of claim 20 wherein said undesirable activity comprises a member of the group 
consisting of: 

sending a large number of e-mails {column 1, lines 14-20), sending e-mails of 
relatively large sizes {column 1, lines 17-19), using a relatively large amount of TCP 
connection time {column 26, lines 1-11), and causing a TCP timeout {column 33, lines 
20-23; Note the occurrence of the interrupted TCP connection). 

Regarding claim 23: The combination of Donaldson-Porras teaches the method 
of claim 20 wherein said system resource usage value is a function of a member of the 
group consisting of: the number of concurrent TCP connections being maintained 
{column 25, lines 59-64), the number of e-mail files in an incoming message queue, and 
the amount of disk space being utilized for an incoming message queue {column 5, 
lines 52-58; Donaldson et al disclose a message store and its mail queue that keeps 
undelivered messaged for up to a week). 

Regarding claim 24: The combination of Donaldson-Porras teaches a 
communication device for determining the disposition of incoming e-mail from a sender, 
said device comprising: 

a sender penalty count data structure for storing a current penalty count value 
associated with the sender {column 23, lines 25-36; fig, 16, items 1500-1518; note that 
the data structure is represented by table 4 in column 23 and that matching count 
represents the penalty count); 

a system resource usage status file for storing a current usage status value for 
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device e-mail processing resources {column 17, lines 27-48; note that the system 
resource becomes unavailable for email processing once the proxy determines that the 
remote network has been placed in a blacklisted database)] and 

an accept/reject filter for disposing of the incoming e-mail on the basis of said 
penalty count value [see Porras, column 12, lines 27-40]. 

Regarding claim 25: The combination of Donaldson-Porras teaches a method 
claim 24 wherein said sender penalty count data structure includes an entry comprising 
a member of the group consisting of: 

a sender identification value {column 22, lines 40-44), 

a cumulative penalty count value {column 22, lines 46-49), 

a cumulative e-mail count {column 32, lines 41-45; note that the number of 
recipient here represents the number of emails), 

a total e-mail size (column 32, lines 45-48), 

a total TCP connection time {column 26, lines 9-11), and 

a timestamp value {column 4, line 27). 

Regarding claim 26: The combination of Donaldson-Porras teaches a method 
suitable for use in a communication device for determining the disposition of incoming 
e-mail from a sender, said method comprising the steps of: 

identifying the e-mail sender by determining a sender IP address {column 6, lines 
14-24)] 

obtaining a previous sender penalty count value calculated for said sender IP 
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address {column 22, lines 40-49; note that the matching mechanism is used here as the 
penalty count and that the 32-bit address for the remote host is used to calculate the IP 
address of its 20 neighbors), wherein the said previous sender penalty cx)unt and 

accepting or rejecting the incoming e-mail based on said sender penalty count 

value {column 3, lines 43-45) and said usage status [see Porras, column 12, lines 27- 

401 

Regarding claim 27: The combination of Donaldson-Porras teaches the method 
of claim 26 further comprising the steps of: 

maintaining a behavior trace table entry for the e-mail sender {column 21-22, 
table 3); and 

determining said previous sender penalty count from said behavior trace table 
{column 21-22, table 3, offset value). 

Regarding claim 28: The combination of Donaldson-Porras teaches the method 
of claim 27 further comprising the step of updating sender behavior values in said trace 
table entry in response to receipt of a sender e-mail {column 17, lines 65-67; column 
18, lines 1-7; fig. 14, item 1408; note that if the sender's IP address matches an entry in 
the blacklist database, the proxy server issues an error reply to the remote host, closes 
the connection, logs the rejected connection, and exits without any email being 
transferred). 

Regarding claim 29: The combination of Donaldson-Porras discloses the 
method of claim 28 wherein said sender behavior values include a member of the group 
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consisting of: the number of e-mails, the total size of e-mails, and total time of TCP 
connection time (see Doaldson; column 32, lines 41-47; column 14, lines 43-47),. 

Regarding claim 30: The combination of Donaldson-Porras teaches the method 
of claim 28 wherein said step of updating sender behavior values comprises the steps 
of: 

reducing said behavior trace table value by a time-dependent decay factor 
{column 21, lines 45-67; column 21, table 3; the offset value tias a decay factor +1)\ and 

adding a current behavior trace table value to said corresponding reduced 

behavior trace table value {column 21, lines 45-67; column 21, table 3). 

Regarding claim 32: The combination of Donaldson-Porras teaches the method 
of claim 26 wherein said sender penalty count value is determined from undesirable 
sender activity occurring over a pre-established retention period {column 5, lines 52-58; 
note that the relay host will usually keep undelivered messages in its queue for up to a 
week). 

Regarding claim 33: The combination of Donaldson-Porras teaches the method 
of claim 32 wherein said undesirable activity comprises a member of the group 
consisting of: 

sending a large number of e-mails (column 1, lines 14-20), sending e-mails of 
relatively large sizes (column 1 , lines 17-19), using a relatively large amount of TCP 
connection time (column 26, lines 1-11), and causing a TCP timeout (column 5, line 52- 
54; column 33, lines 20-23; note the occurrence of the interrupted TCP connection). 
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Regarding claim 34: The combination of Donaldson-Porras teaches the method 
of claim 26 further comprising the step of updating said previous sender penalty count 
value {column 21, lines 12-15). 

Regarding claim 37: The combination of Donaldson-Porras teaches the method 
for by a communication device for determining the disposition of incoming e-mail from a 
sender {column 2, lines 37-41; fig. 1, items 1045-1048), said method comprising steps 
of: 

establishing an identity of the sender {column 6, lines 14-20; column 14, lines 63- 
67; fig. 14, items 1401-1406): 

determining a cumulative penalty count value associated with said identity, wherein 
said cumulative penalty count is based on a behavior of the undesirable activity 
performed by sender [see Porras, column 12, lines 27-40]. 

retrieving a system overall resource usage status associated with the 
communication device {column 6, lines 42-52)] and 

processing the incoming e-mail based on the cumulative penalty count value and 
the system overall resource usage status {column 22, lines 28-33; column 16, 12-19). 

Regarding claim 38: The combination of Donaldson-Porras teaches the method 
of claim 37, wherein said step of establishing the identity of the sender comprises the 
step of ascertaining an IP address of the sender {column 6, lines 14-20). 

Regarding claim 40: The combination of Donaldson-Porras teaches the method 
of claim 37, wherein said cumulative penalty count value comprises a prior penalty 
count value reduced by a time-dependent decay 1ao{or{column 21, lines 12-56; note that 
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the filter scans the node name of the remote host for certain sequences and adds or 
subtracts points). 

Regarding claim 41: The combination of Donaldson-Porras teaches the method 
of claim 37 wherein said step of processing the incoming e-mail comprises the step of 
assigning an operating state to the communication device, said operating state being a 
function of said system time-dependent resource usage status {column 16, lines 12-19). 

5. Claims 11-13, 17, 42-44, and 48 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Donaldson and Porras, in view of Munger et al (Munger), U.S. 
6,502,135 B1). 

Regarding claims 11 and 42, the combination Donaldson-Porras teaches the 
invention substantially as claimed. Donaldson discloses a method, wherein said 
operating state is a member of the group consisting of a normal operating state (see 
Donaldson; column 16, lines 15-19), and a selective-rejection operating state (see 
Donaldson; column 14, lines 63-67, column 15, lines 1-2), but fails to specifically 
disclose a random-rejection operating state. 

In the same field of endeavor, Munger discloses (..a random sync values that 
feed a random number generator, to prevent spooling attacks using a hashing 
technique of a time stamp or sequence number, and to establish the concept of future 
and past states while validating or rejecting the incoming packets in a network device...) 
[see Munger, column 26, lines 14-45\. 
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Accordingly, it would have been obvious to one of ordinary skill in the networking 
art at the time the invention was made to have incorporated Munger's teachings of the 
random rejection of incoming packets, with the teachings of Donaldson, for the purpose 
of " getting advantage of quickly rejecting packets from unautliorized users sucti as 
hacker computer 3105. . . " as stated by Munger in lines 25-36 of column 45. By this 
rationale claims 11 and 42 are rejected. 

Regarding claims 12 and 43, the combination Donaldson-Porras-Munger 
teaches a method wherein, for said selective-rejection state, if said cumulative penalty 
count value has a zero value, said step of processing the incoming e-mail comprises the 
step of accepting the incoming e-mail [see column 17, lines 38-67], The same 
motivation that was utilized in the combination of claims 1 1 and 42, applies equally as 
well to claim 12 and 43 [see Munger, column 45, lines 25-36]. By this rationale claims 
12 and 43 are rejected. 

Regarding claims 13 and 44: the combination Donaldson-Porras-Munger 
teaches a method wherein, for said selective-rejection state, if said cumulative penalty 
count value has a nonzero value [see Donaldson, column 22, lines 34-62], said step of 
processing the incoming e-mail comprises the steps of: specifying a rejection factor; 
generating a random number; and randomly rejecting the incoming e-mail on the basis 
of said rejection factor and said random number [see Munger, column 28, lines 5-67, 
column 29, lines 1-64]. The same motivation that was utilized in the combination of 
claims 1 1 and 42, applies equally as well to claim 13 and 44 [see Munger, column 45, 
lines 25-36]. By this rationale claims 13 and 44 are rejected. 
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Regarding claims 17 and 48: the combination Donaldson-Porras-Munger 
teaches a method wherein if said cumulative penalty count value has a zero value [see 
Donaldson, column 17, lines 59-67], said step of processing the incoming e-mail 
comprises the steps of: deriving an overall resource usage factor; generating a random 
number; and randomly rejecting the incoming e-mail on the basis of said overall 
resource usage factor, said random number, and said cumulative penalty count value 
[see Munger, column 28, lines 5-67, column 29, lines 1-64]. The same motivation that 
was utilized in the combination of claims 11 and 42, applies equally as well to claim 17 
and 48 [see Munger, column 45, lines 25-36]. By this rationale claims 17 and 48 are 
rejected. 



Response to Arguments 

8. Applicant's Request for Reconsideration filed on November 1 1/04/2005 has been 
carefully considered but is not deemed fully persuasive. However, because there exists 
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the likelihood of future presentation of this argument, the Examiner thinks that it is 
prudent to address Applicants' main points of contention. 

A. Applicants contend Donaldson provides an email filter which examines the 
hostname of the SMTP server sending an email. Donaldson's filter compares the 
name of the connecting host with its immediate neighbors, using a heuristic 
approach to correlate a sequence of names ms dialups or non-dialups." 

(Col. 21, lines 3-6) There is no undesirable activity performed by the sender 
alleged in Donaldson. 

B. Applicants contend that "there is no retrieving and there is no system overall 
resource usage status retrieved, merely the deallocating of resources and 
resetting of state variables associated with a single email message". 

C. Applicants contend Donaldson cannot process incoming e-mail based on the 
system overall resource usage status. 

D. Applicants contend Applicant notes with appreciation the indication of 
allowable subject matter in claims 14-16, 18-19, 31, 35, 36, 45-47, and 49-50. 
Applicant has not rewritten these claims in independent form because Appljcant 
maintains that all claims are presently allowable bmsed on the arguments and 
remarks presented herein. Furthermore, claims 18, 19, 31, 35, 46, and 50 have 
been amended merely to reflect changes in their respective base claims. 

E. Applicant contends that claims 11-13 rejection over Donaldson in view of 
Munger is respectfully traversed, because there is no motivation or suggestion to 
combine Donaldson with Munger 
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9. As to " Point A " it is the position of the Examiner that Donaldson does not teach in 
details undesirable activity performed by the sender. However new patent reference of 
Porras teaches this limitation of the claim. See rejection of claim 1 above. 

As to " points B ". it is also the Examiner's position that Donaldson a 
threaded Impl^meht^^^ prbky- sjnlpl;^:<|kits, -iji; itiulfi-thr^a^^^ 

th^:p!P)<y 

riolopg^^^ Donaldson, page 16, column 12-20]. 

As to " point C " it is the examiner's position that there is sufficient motivation or 
suggestion to combine Donaldson with Munger to reject claims 11-13 over Donaldson in 
view of Munger [see rejection of claims 11-13 above]. 

As to " point D " [see rejection of independent claims 1, 20, 24, 26, and 37 above]. 

As to " point E " it is the examiner's position that there is sufficient motivation or 
suggestion to combine Donaldson with Munger to reject claims 11-13 over Donaldson in 
view of Munger [see rejection of claims 1 1-13 above]. 

Examiner notes with delight that no new matter has been added and that the new 
claims are supported by the application as filed. However, applicant has failed in 
presenting claims and drawings that delineate the contours of this invention as 
compared to the cited prior art. Applicant has failed to clearly point out patentable 
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novelty in view of the state of the art disclosed by the references cited that would 
overcome the 102(e) anticipation and the 103(a) rejections applied against the claims, 
the rejection is therefore sustained. 
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Conclusion 



10. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE NON-FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

1 1 . Any inquiry concerning this communication or earlier communications from 
examiner should be directed to Jude Jean-Gilles whose telephone number is (571) 272- 
3914. The examiner can normally be reached on Monday-Thursday and every other 
Friday from 8:00 AM to 5:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner^s 
supervisor, David Wiley, can be reached on (571) 272-3923. The fax phone number for 
the organization where this application or proceeding is assigned is (703) 305-3719. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 

Jude Jean-Gilles 
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